The regulatory perimeter inside which AI-driven security operations and continuously-retraining detection now have to operate.
Every framework below is enforceable today or about to be. Velma evidence is the format both sides expect.
Sorted by soonest deadline first.
DoD contractors handling Controlled Unclassified Information must achieve Level 3 certification, with continuous monitoring and per-decision evidence for any AI-driven security controls in the boundary.
Phased rollout from final rule (16 Dec 2024). Roughly 80,000 contractors affected. AI-controls evidence is becoming the binding constraint for primes and their subs.
Threat-detection, biometric-access, and critical-infrastructure security AI classified high-risk must ship with documented risk management, automatic record-keeping, human oversight, and regulator-readable audit trails.
Standalone systems 2 Dec 2027; embedded systems (XDR / EDR / MDR platforms) 2 Aug 2028 under Omnibus VII. Fines up to 7% of global turnover. The audit-format gap is the per-decision record runtime governance closes.
The examiner can cite any of these on first request.
Public companies must disclose material cybersecurity incidents within four business days on Form 8-K, with annual disclosure of governance and risk-management processes including AI-driven security controls.
In force. The four-day clock is unforgiving when the decision graph that produced the response is not reproducible. Audit-chain governance closes the materiality-attribution gap.
Five stages. The evidence artifact. Sealed forecasts at horizon. Isometric DFD-0.
Formal safety models, ODD, assurance cases, reviewer briefs.
How we are set up and why the trust structure matters.
Direct line to the inventor. No demo, no deck.
Thirty minutes. Architecture, not sales. On the regulatory surface you already know.
